otto-execute 0.1.0

package/dist/mutations.js

@@ -0,0 +1,363 @@
+/**
+ * mutations.ts — the consistency matrix (mutation cases the adapter MUST refuse).
+ *
+ * Each entry derives an INCONSISTENT variant of a VALID artifact and names the exact refusal the
+ * adapter must produce. Used twice: by the test suite (every refusal must redden — delete a check
+ * in verify.ts and its row fails) and by the sitting's fence section (the BYO "policy engine" is the
+ * adapter itself; these rows are its out-of-policy inputs, graded BLOCKED / LEAKED by the ladder).
+ * Same vocabulary as the constructor's own mutation proofs (`test/*-mutation-proof.ts`).
+ *
+ * Two mutation models, deliberately both:
+ *   - `recommit: false` — bytes change, digests are left stale. The integrity layer catches it.
+ *   - `recommit: true`  — payload + commitment digests are recomputed (they are unkeyed keccak over
+ *     public content, so any party holding the artifact can). Only the adapter's INTENT and POLICY
+ *     layers can catch these. A verifier that stopped at digests would grade every one of them LEAKED.
+ *
+ * Every row names the layer expected to catch it. Rows caught by the shared envelope schema are kept
+ * (they document the contract) but are NOT evidence for a verifier-local check; the verifier-local
+ * checks each have their own row(s) below.
+ *
+ * Deliberately NOT a row: an internal DEX leg re-pointed at a foreign contract with the receiver and
+ * minimum output intact. The adapter does not hold an allowlist of every DEX; that leg is bounded
+ * ON-CHAIN by the router's `_receiver` + `_minAmount` enforcement (GenericSwapV3 reverts unless the
+ * receiver gets at least the minimum), which is why the intent floor must be positive and the
+ * caller's own (verify.ts layer 2).
+ */
+import { decodeFunctionData, encodeFunctionData, getAddress, parseAbi } from 'viem';
+import { decodeCollectTokenFees, decodeGenericSwap, encodeCollectTokenFees, encodeGenericSwap, } from './lifi-decode.js';
+import { artifactCommitmentDigest, executionDigest } from './vendor/otto-intel-mcp/execution-index.js';
+/** A foreign address no reviewed table names; the mutation target for every substitution row. */
+export const FOREIGN_ADDRESS = getAddress('0x000000000000000000000000000000000000dEaD');
+/** A foreign ERC20 no intent names (Base USDbC), for token substitutions. */
+export const FOREIGN_TOKEN = getAddress('0xd9aAEc86B65D86f6A7B5B1b0c42FFA531710b6CA');
+const ERC20_APPROVE_ABI = parseAbi([
+    'function approve(address spender, uint256 amount) returns (bool)',
+]);
+function clone(artifact) {
+    return structuredClone(artifact);
+}
+/** Recompute both digests with the constructor's public canonicalization, as any holder of the artifact could. */
+export function recommit(artifact) {
+    const next = clone(artifact);
+    const { artifact_digest: _dropped, ...submission } = next.submission;
+    const uncommitted = { ...next, submission: { ...submission, payload_digest: executionDigest(next.payload) } };
+    return {
+        ...uncommitted,
+        submission: { ...uncommitted.submission, artifact_digest: artifactCommitmentDigest(uncommitted) },
+    };
+}
+function withSteps(artifact, edit) {
+    const next = clone(artifact);
+    next.payload = { ...next.payload, steps: edit(next.payload.steps) };
+    return next;
+}
+function withCallData(artifact, data) {
+    return withSteps(artifact, (steps) => steps.map((step, index) => (index === 2 ? { ...step, data } : step)));
+}
+function callData(artifact) {
+    return artifact.payload.steps[2].data;
+}
+function rewriteSwap(artifact, edit) {
+    return withCallData(artifact, encodeGenericSwap(edit(decodeGenericSwap(callData(artifact)))));
+}
+function isForwarder(forwarders, address) {
+    return forwarders.some((forwarder) => getAddress(forwarder) === getAddress(address));
+}
+function rewriteFeeLeg(artifact, forwarders, edit) {
+    return rewriteSwap(artifact, (swap) => ({
+        ...swap,
+        legs: swap.legs.map((leg) => isForwarder(forwarders, leg.callTo)
+            ? { ...leg, callData: encodeCollectTokenFees(edit(decodeCollectTokenFees(leg.callData))) }
+            : leg),
+    }));
+}
+function rewriteApproval(artifact, index, edit) {
+    return withSteps(artifact, (steps) => steps.map((step, i) => {
+        if (i !== index)
+            return step;
+        const decoded = decodeFunctionData({ abi: ERC20_APPROVE_ABI, data: step.data });
+        const [spender, amount] = edit(getAddress(decoded.args[0]), decoded.args[1]);
+        return { ...step, data: encodeFunctionData({ abi: ERC20_APPROVE_ABI, functionName: 'approve', args: [spender, amount] }) };
+    }));
+}
+export const MUTATION_CASES = Object.freeze([
+    {
+        id: 'F1-bytes-no-recommit',
+        what: 'flip one calldata byte, leave the digests alone',
+        recommit: false,
+        expect: 'DIGEST_MISMATCH',
+        layer: 'integrity',
+        mutate: (artifact) => {
+            const data = callData(artifact);
+            const flipped = `${data.slice(0, -2)}${data.endsWith('00') ? '01' : '00'}`;
+            return withCallData(artifact, flipped);
+        },
+    },
+    {
+        id: 'F2-expired',
+        what: 'back-date valid_until before its artifact_id construction time (digests recomputed) — the envelope schema itself refuses',
+        recommit: true,
+        expect: 'SCHEMA_INVALID',
+        layer: 'schema',
+        mutate: (artifact, context) => {
+            const next = clone(artifact);
+            next.valid_until = new Date(context.nowMs - 60_000).toISOString();
+            return next;
+        },
+    },
+    {
+        id: 'F3-other-account',
+        what: 'artifact bound to a different account than the signer (digests recomputed)',
+        recommit: true,
+        expect: 'ACCOUNT_BINDING_MISMATCH',
+        layer: 'integrity',
+        mutate: (artifact) => {
+            const next = clone(artifact);
+            next.account_binding = {
+                ...next.account_binding,
+                address: FOREIGN_ADDRESS,
+                protocol_roles: { lifi: { sender: FOREIGN_ADDRESS, receiver: FOREIGN_ADDRESS } },
+            };
+            return next;
+        },
+    },
+    {
+        id: 'F4-capability',
+        what: 'an eoa-bound artifact demanding submit_evm_batch (digests recomputed) — the envelope schema itself refuses',
+        recommit: true,
+        expect: 'SCHEMA_INVALID',
+        layer: 'schema',
+        mutate: (artifact) => {
+            const next = clone(artifact);
+            next.required_capabilities = ['submit_evm_batch'];
+            return next;
+        },
+    },
+    {
+        id: 'F5-native-value',
+        what: 'call step carries 1 wei of native value (digests recomputed) — the envelope schema itself refuses',
+        recommit: true,
+        expect: 'SCHEMA_INVALID',
+        layer: 'schema',
+        mutate: (artifact) => withSteps(artifact, (steps) => steps.map((step, index) => (index === 2 ? { ...step, value: '1' } : step))),
+    },
+    {
+        id: 'F6-call-target',
+        what: 'call step re-pointed at a foreign contract while the approvals still name the router (digests recomputed)',
+        recommit: true,
+        expect: 'APPROVAL_INVALID',
+        layer: 'policy',
+        mutate: (artifact) => withSteps(artifact, (steps) => steps.map((step, index) => (index === 2 ? { ...step, to: FOREIGN_ADDRESS } : step))),
+    },
+    {
+        id: 'F7-approve-spender',
+        what: 'both approvals re-pointed at a foreign spender, call re-pointed to match (digests recomputed)',
+        recommit: true,
+        expect: 'TARGET_NOT_ALLOWED',
+        layer: 'policy',
+        mutate: (artifact) => {
+            const repointed = rewriteApproval(rewriteApproval(artifact, 0, (_s, a) => [FOREIGN_ADDRESS, a]), 1, (_s, a) => [FOREIGN_ADDRESS, a]);
+            return withSteps(repointed, (steps) => steps.map((step, index) => (index === 2 ? { ...step, to: FOREIGN_ADDRESS } : step)));
+        },
+    },
+    {
+        id: 'F8-receiver',
+        what: 'swap _receiver redirected to a foreign address (digests recomputed)',
+        recommit: true,
+        expect: 'RECEIVER_MISMATCH',
+        layer: 'policy',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => ({ ...swap, receiver: FOREIGN_ADDRESS })),
+    },
+    {
+        id: 'F9-integrator',
+        what: "swap _integrator changed from 'ottowallet' (digests recomputed)",
+        recommit: true,
+        expect: 'ATTRIBUTION_MISSING',
+        layer: 'policy',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => ({ ...swap, integrator: 'mallory' })),
+    },
+    {
+        id: 'F10-fee-recipient',
+        what: "Otto's fee distribution redirected to a foreign address (digests recomputed)",
+        recommit: true,
+        expect: 'ATTRIBUTION_MISSING',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteFeeLeg(artifact, context.forwarders, (fees) => ({
+            ...fees,
+            distributions: fees.distributions.map((d) => d.recipient === getAddress(context.ottoRecipient) ? { ...d, recipient: FOREIGN_ADDRESS } : d),
+        })),
+    },
+    {
+        id: 'F11-fee-amount',
+        what: "Otto's fee amount halved (digests recomputed)",
+        recommit: true,
+        expect: 'ATTRIBUTION_MISMATCH',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteFeeLeg(artifact, context.forwarders, (fees) => ({
+            ...fees,
+            distributions: fees.distributions.map((d) => d.recipient === getAddress(context.ottoRecipient) ? { ...d, amount: d.amount / 2n } : d),
+        })),
+    },
+    {
+        id: 'F12-fee-stranger',
+        what: 'an extra fee distribution to a stranger appended (digests recomputed)',
+        recommit: true,
+        expect: 'ATTRIBUTION_MISMATCH',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteFeeLeg(artifact, context.forwarders, (fees) => ({
+            ...fees,
+            distributions: [...fees.distributions, { recipient: FOREIGN_ADDRESS, amount: 1n }],
+        })),
+    },
+    {
+        id: 'F13-config-version',
+        what: 'fee_attribution.config_version rewritten to an unruled version (digests recomputed)',
+        recommit: true,
+        expect: 'ATTRIBUTION_MISMATCH',
+        layer: 'policy',
+        mutate: (artifact) => {
+            const next = clone(artifact);
+            next.fee_attribution = { ...next.fee_attribution, config_version: 'lifi-2026-01-01-5bps-v0' };
+            return next;
+        },
+    },
+    {
+        id: 'F14-fee-leg-removed',
+        what: 'the FeeForwarder leg deleted, the DEX leg re-flagged as the deposit for the full amount (digests recomputed)',
+        recommit: true,
+        expect: 'ATTRIBUTION_MISSING',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteSwap(artifact, (swap) => {
+            const legs = swap.legs.filter((leg) => !isForwarder(context.forwarders, leg.callTo));
+            if (legs.length === swap.legs.length || legs.length === 0) {
+                throw new Error('fixture has no separable fee leg; F14 needs a multi-leg swap');
+            }
+            const gross = swap.legs.filter((leg) => leg.requiresDeposit).reduce((sum, leg) => sum + leg.fromAmount, 0n);
+            const [first, ...rest] = legs;
+            return { ...swap, legs: [{ ...first, requiresDeposit: true, fromAmount: gross }, ...rest] };
+        }),
+    },
+    {
+        id: 'F15-fee-collector-unreviewed',
+        what: 'the fee leg callTo + approveTo moved to an unreviewed collector, everything else intact (digests recomputed) — the user-side drift alarm',
+        recommit: true,
+        expect: 'ATTRIBUTION_MISSING',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteSwap(artifact, (swap) => ({
+            ...swap,
+            legs: swap.legs.map((leg) => isForwarder(context.forwarders, leg.callTo) ? { ...leg, callTo: FOREIGN_ADDRESS, approveTo: FOREIGN_ADDRESS } : leg),
+        })),
+    },
+    {
+        id: 'F16-min-output-zero',
+        what: 'swap _minAmount set to 0 (digests recomputed) — a swap that may deliver nothing',
+        recommit: true,
+        expect: 'MIN_OUTPUT_TOO_LOW',
+        layer: 'intent',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => ({ ...swap, minAmount: 0n })),
+    },
+    {
+        id: 'F17-duplicate-deposit',
+        what: 'the deposit leg duplicated so the router pulls twice the intent amount (digests recomputed)',
+        recommit: true,
+        expect: 'SWAP_CALLDATA_INVALID',
+        layer: 'intent',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => {
+            const deposit = swap.legs.find((leg) => leg.requiresDeposit);
+            if (!deposit)
+                throw new Error('fixture has no deposit leg');
+            return { ...swap, legs: [deposit, ...swap.legs] };
+        }),
+    },
+    {
+        id: 'F18-approve-oversized',
+        what: 'the approval doubled while the deposit legs still pull the intent amount (digests recomputed) — residual allowance',
+        recommit: true,
+        expect: 'INTENT_MISMATCH',
+        layer: 'intent',
+        mutate: (artifact) => rewriteApproval(artifact, 1, (spender, amount) => [spender, amount * 2n]),
+    },
+    {
+        id: 'F19-output-token',
+        what: 'the last leg delivers a foreign token instead of the intent output token (digests recomputed)',
+        recommit: true,
+        expect: 'INTENT_MISMATCH',
+        layer: 'intent',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => ({
+            ...swap,
+            legs: swap.legs.map((leg, index) => (index === swap.legs.length - 1 ? { ...leg, receivingAssetId: FOREIGN_TOKEN } : leg)),
+        })),
+    },
+    {
+        id: 'F20-deposit-token',
+        what: 'the deposit leg pulls a foreign token while the approval still names the intent token (digests recomputed)',
+        recommit: true,
+        expect: 'SWAP_CALLDATA_INVALID',
+        layer: 'intent',
+        mutate: (artifact) => rewriteSwap(artifact, (swap) => ({
+            ...swap,
+            legs: swap.legs.map((leg) => (leg.requiresDeposit ? { ...leg, sendingAssetId: FOREIGN_TOKEN } : leg)),
+        })),
+    },
+    {
+        id: 'F22-bytes-payload-digest-only',
+        what: 'one calldata byte flipped and ONLY the payload digest recomputed (commitment stale) — isolates the commitment check',
+        recommit: false,
+        expect: 'DIGEST_MISMATCH',
+        layer: 'integrity',
+        mutate: (artifact) => {
+            const data = callData(artifact);
+            const flipped = `${data.slice(0, -2)}${data.endsWith('00') ? '01' : '00'}`;
+            return recommitPayloadOnly(withCallData(artifact, flipped));
+        },
+    },
+    {
+        id: 'F23-bytes-commitment-only',
+        what: 'one calldata byte flipped and ONLY the commitment recomputed (payload digest stale) — isolates the payload-digest check',
+        recommit: false,
+        expect: 'DIGEST_MISMATCH',
+        layer: 'integrity',
+        mutate: (artifact) => {
+            const data = callData(artifact);
+            const flipped = `${data.slice(0, -2)}${data.endsWith('00') ? '01' : '00'}`;
+            return recommitCommitmentOnly(withCallData(artifact, flipped));
+        },
+    },
+    {
+        id: 'F24-fee-leg-receiving-token',
+        what: 'the fee leg declared to receive a foreign token while forwarding the intent token (digests recomputed)',
+        recommit: true,
+        expect: 'ATTRIBUTION_MISMATCH',
+        layer: 'policy',
+        mutate: (artifact, context) => rewriteSwap(artifact, (swap) => ({
+            ...swap,
+            legs: swap.legs.map((leg) => (isForwarder(context.forwarders, leg.callTo) ? { ...leg, receivingAssetId: FOREIGN_TOKEN } : leg)),
+        })),
+    },
+    {
+        id: 'F21-approve-token',
+        what: 'both approvals moved to a foreign token contract (digests recomputed)',
+        recommit: true,
+        expect: 'INTENT_MISMATCH',
+        layer: 'intent',
+        mutate: (artifact) => withSteps(artifact, (steps) => steps.map((step, index) => (index < 2 ? { ...step, to: FOREIGN_TOKEN } : step))),
+    },
+]);
+/** Recompute ONLY the payload digest (commitment left stale) — isolates the commitment check. */
+export function recommitPayloadOnly(artifact) {
+    const next = clone(artifact);
+    next.submission = { ...next.submission, payload_digest: executionDigest(next.payload) };
+    return next;
+}
+/** Recompute ONLY the whole-envelope commitment (payload digest left stale) — isolates the payload-digest check. */
+export function recommitCommitmentOnly(artifact) {
+    const next = clone(artifact);
+    const { artifact_digest: _dropped, ...submission } = next.submission;
+    const uncommitted = { ...next, submission };
+    return { ...uncommitted, submission: { ...submission, artifact_digest: artifactCommitmentDigest(uncommitted) } };
+}
+export function applyMutation(mutation, artifact, context) {
+    const mutated = mutation.mutate(artifact, context);
+    return mutation.recommit ? recommit(mutated) : mutated;
+}
+//# sourceMappingURL=mutations.js.map

package/dist/refusal.d.ts

@@ -0,0 +1,2 @@
+/** refusal.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { ADAPTER_REFUSAL_CODES, AdapterRefusal, isAdapterRefusal, isAdapterRefusalCode, refuse, type AdapterRefusalCode, } from './vendor/otto-intel-mcp/adapter-index.js';

package/dist/refusal.js

@@ -0,0 +1,3 @@
+/** refusal.ts — re-exported from `./vendor/otto-intel-mcp/adapter-index.js` (moved 2026-08-29; see that entry's header). */
+export { ADAPTER_REFUSAL_CODES, AdapterRefusal, isAdapterRefusal, isAdapterRefusalCode, refuse, } from './vendor/otto-intel-mcp/adapter-index.js';
+//# sourceMappingURL=refusal.js.map

package/dist/vendor/otto-intel-mcp/VENDORED.json

@@ -0,0 +1,52 @@
+{
+  "note": "Generated by scripts/vendor-seam.mjs — file-for-file copies of the published otto-intel-mcp dist. Do not edit.",
+  "package": "otto-intel-mcp",
+  "version": "0.1.1",
+  "resolved": "https://registry.npmjs.org/otto-intel-mcp/-/otto-intel-mcp-0.1.1.tgz",
+  "integrity": "sha512-cpLVyjhW0iU4dKVaEPeTgEwswEX0RwO8KfeWcajH5qCR/IoAA/83RQWyREhhHjy0yLAOB/q2fxwfvpIt1Xv7Aw==",
+  "entries": {
+    "otto-intel-mcp/execution": "execution-index.js",
+    "otto-intel-mcp/adapter": "adapter-index.js",
+    "otto-intel-mcp/adapter-cdp": "adapter-cdp-index.js"
+  },
+  "files": {
+    "adapter-cdp-index.js": "6b83915a79abbccb942aaa49692d71df2bb933cf4933935cab60fb9c32ba8f49",
+    "adapter-cdp-index.d.ts": "4435c07c18064fdad282106a6e40a600780db32b306f523a65dcabb10ae38ba9",
+    "adapter-index.js": "778732e9dcf8be8519e3862751ccdd5fb3aa5d2f6a474ef2f85df1ad81ceee05",
+    "adapter-index.d.ts": "90ede35e090903ddda98ac3c4a609073140cabc9868b10c25e25d93fc6bf5b1a",
+    "adapter/cdp-signer.js": "bd889add6a3f574dab8a30be6a5fdfcd815328cbdae14089af768e779e08cee6",
+    "adapter/cdp-signer.d.ts": "eb59580813aacfb4e34097d4cc2d9b3ddea27f0c04eb88b7dcc0b88625bef63e",
+    "adapter/chain.js": "b95f2d390275736c63426bbbacb2c958fb42d23bbcfb76b6dbe9c3fe6236e727",
+    "adapter/chain.d.ts": "1902f4876dfac155a35550c6ea2d6ebdf2d6f52e320a9d8ef6253bf97e1bd9e4",
+    "adapter/erc20.js": "3d24577b13ce21bcff657a8e90b425bfd77a44d7764d8955b6533c48c77354e1",
+    "adapter/erc20.d.ts": "ac5e6c0c759fc775e7227c2af148ba5532f3775eed251b89fa12dab5d198a3ec",
+    "adapter/lifi-decode.js": "e703367f243b592f46d5d160a2352b38a37ed5e91563e9e6968d4a409a2c463b",
+    "adapter/lifi-decode.d.ts": "962b7f6cc6d7beded0b43fed55620524931695ac1e683f9b6a006ec8f2525349",
+    "adapter/refusal.js": "1179cf581744070c4922154a9da3f06026ba37c7195bfb7cd2e66bdc4ddab67b",
+    "adapter/refusal.d.ts": "c75c66a5cf2fd718efdae60a5acae126888cc597a95207626c6d8a383d3dafe4",
+    "adapter/sent-step.js": "d4d0cfda10c49e63e179433335e00323f064fe4b22d60aec64f36dd2292dfb28",
+    "adapter/sent-step.d.ts": "35365162eb1023d124fdebcf9688ef2b986ff0dd71b092390e923aef9abdeb1a",
+    "adapter/verify.js": "fa10c8501c1fa626adf1992b62caa60abb3aaa268d620e1333d104016cea3b1d",
+    "adapter/verify.d.ts": "714128e2734b1b8b0ab24686b0efdeb63a67ce79c2bd4a4649306d56d05a8e7c",
+    "artifact-id.js": "896898a48d89c6d05b983c76d50c947462807691bfc5e00cfeb9cec07286e274",
+    "artifact-id.d.ts": "abc817b5bdb48608a6c2b6f83d8d06406c9d38fc53d1339851858e5feced395a",
+    "execution-config.js": "8704b3a5d8b7ff5d84c5bb7d7ac41c4b7b6124824d21e22b8a9f345aac63075b",
+    "execution-config.d.ts": "ec15569b3d962d2bfd7c297236362873795c0db2021464d15ad5bcb3b0190fcd",
+    "execution-delegated-definition.js": "6d4d558bb00b54f4ed320f966f2311239a263ac991e3922ddc0b722d845046b3",
+    "execution-delegated-definition.d.ts": "0e6febe4772188b4be0eb6e1a4f2416873c1da44ed8f35dc88896af1c049456d",
+    "execution-delegation-admin-definition.js": "9000403e3d9a67547ac4ca5eeb74fb8f938b2ac3b016eacee41ff2ce76f97239",
+    "execution-delegation-admin-definition.d.ts": "832c15a02a623be13bd7c3e4d43052be86c758ec7b4a222d4b29265fb9119c10",
+    "execution-delegation-policy.js": "a86ddfb60f8078f35c59cb7bf49be8ef77c12deae609e317e173996de0b3ef49",
+    "execution-delegation-policy.d.ts": "c6474159265af06c4e6418b45dbb0731c5a670932158b22e08e80aebbe64291c",
+    "execution-errors.js": "b550422d30149763d12eb6cfb42133e95ce820d6fc9885b4dae8b4180e10dbca",
+    "execution-errors.d.ts": "60d719e6225531d12c069fa69de9f6cc9bae5c6828f7b18a15c66dc4181f2286",
+    "execution-index.js": "291d83798a65cac2f5998492b1e273a893f21cf00a39c120ba86e9e775256473",
+    "execution-index.d.ts": "742d0af2f37747da56f54c8e0484e9d0c6e0847e79c41cc8c35b3872cfdc06a9",
+    "execution-intent.js": "11a3f0012679d3a91e57f0b980656897f322f89ff369d7ef3da8f5f91bc2b780",
+    "execution-intent.d.ts": "648d0f7b06a7ec544b040f2ee3e99b55bb328602ff4a7a0cb6761e5c46778613",
+    "execution-tool-definitions.js": "27a55d41e5b44f3eca9c36403c096cff2fcc87345140f5696415df7765656382",
+    "execution-tool-definitions.d.ts": "67013d0f42fdd888e28413601a7824b5d01d39416f3991b2c02a6df8e7d2e5b6",
+    "execution-types.js": "744f399fd92178d67e65041494d552bcff115eca48c0ee948acb5752a34e662b",
+    "execution-types.d.ts": "53b4823bfffdada869b9111cf49635436ca78971c3df412727f1d7a8d8afac49"
+  }
+}

package/dist/vendor/otto-intel-mcp/adapter/cdp-signer.d.ts

@@ -0,0 +1,133 @@
+/**
+ * cdp-signer.ts — the CDP-delegated capability provider, product-shaped.
+ *
+ * The end user has ALREADY signed in and minted a time-boxed delegation somewhere else (a dApp, the
+ * proof kit's OTP flow, …). This adapter holds Otto's developer-side CDP access and submits the
+ * user's OWN transactions under that delegation: user-authenticated, Otto-governed (the project policy
+ * is the fence), Otto-revocable. It never holds a user key, never mints a grant, and submits ONLY a
+ * plan that `assertPlanSignableBy` accepts for THIS user.
+ *
+ * RUNTIME privacy, not TypeScript privacy: the raw "send this unsigned transaction under the user's
+ * delegation" capability lives in a module-private WeakMap keyed by the rig object. A `CdpRig` value
+ * exposes only chain reads, delegation read-back and revocation; the signer reaches the raw send
+ * through the WeakMap, and its own submission path is a `#private` method. Nothing reachable from a
+ * rig or a signer can submit an unverified transaction.
+ *
+ * Lifecycle serialization lives on the RIG, not on the signer: `sendPlan`, its allowance clear, the
+ * signer's `revokeDeveloperSide` AND the rig's public `revoke` all run through one module-private lock
+ * per rig, so a revocation issued by anyone holding the rig can never race an in-flight plan or its
+ * cleanup. Revocation is a FAIL-CLOSED per-user transition: the lock is held through the raw revoke AND
+ * its read-back, and once revocation has been REQUESTED for a user on a rig, no plan for that user is
+ * ever submitted on that rig again — confirmed, unconfirmed or failed. A halted plan's clear is
+ * confirmed by an `allowance` read-back, never inferred from a receipt.
+ *
+ * Nonce, gas and serialization are adapter-owned (spec §6): the unsigned EIP-1559 transaction is
+ * assembled here from chain reads and handed to CDP to sign and broadcast.
+ */
+import { type Address, type Hex, type PublicClient } from 'viem';
+import { type SealedWaitOptions } from './chain.js';
+import type { SentStep } from './sent-step.js';
+import { type SigningCapability, type VerifiedSwap } from './verify.js';
+export declare const CDP_CAPABILITIES: readonly SigningCapability[];
+export declare const CHAIN_ID: 8453;
+export declare const NETWORK: "base";
+export interface CdpDeveloperCredentials {
+    readonly apiKeyId: string;
+    readonly apiKeySecret: string;
+    readonly walletSecret: string;
+}
+export interface CdpEndUser {
+    readonly userId: string;
+    readonly address: Address;
+}
+/** The PUBLIC face of a rig: chain reads, delegation read-back, revocation. No submission surface. */
+export interface CdpRig {
+    readonly pub: PublicClient;
+    readDelegation(userId: string): Promise<{
+        expiresAt: string;
+    } | undefined>;
+    /**
+     * Request revocation and confirm it by read-back, serialized with every plan on this rig. Resolves
+     * only once the grant no longer reads back; rejects if it still does. Either way the user is marked
+     * revocation-requested on this rig and no later plan for them is submitted (fail-closed).
+     */
+    revoke(userId: string): Promise<void>;
+}
+/** The raw capabilities a rig is built from. Held privately by this module once the rig exists. */
+export interface CdpRawOperations {
+    readonly pub: PublicClient;
+    /** Sign + broadcast an unsigned serialized EIP-1559 transaction under the user's delegation. Returns the tx hash. */
+    submit(user: CdpEndUser, unsignedTransaction: Hex): Promise<Hex>;
+    revoke(userId: string): Promise<void>;
+    readDelegation(userId: string): Promise<{
+        expiresAt: string;
+    } | undefined>;
+}
+/** True once `rig.revoke(userId)` has been called on this rig, whatever it returned. */
+export declare function revocationRequested(rig: CdpRig, userId: string): boolean;
+/**
+ * Why a delegated plan halted — a closed vocabulary the signer sets from STRUCTURED facts only (the CDP
+ * `errorType`, an error's class, the receipt status, its own checks). Message text never selects it, so
+ * upstream text cannot steer the class a consumer reports.
+ */
+export type DelegatedHaltCause = 'policy_violation' | 'delegation_not_active' | 'artifact_no_longer_signable' | 'reverted' | 'receipt_not_sealed' | 'upstream_failure';
+/**
+ * A delegated plan halted; `cause` is the structured class above, `allowanceCleared` says whether the
+ * router allowance is known to be zero again. The message is for the operator; a consumer that must not
+ * relay upstream text reads `cause` and the two fields only.
+ */
+export declare class DelegatedPlanHaltedError extends Error {
+    readonly failedStep: number;
+    readonly allowanceCleared: boolean;
+    readonly cause: DelegatedHaltCause;
+    readonly clearTransactionHash?: Hex | undefined;
+    constructor(message: string, failedStep: number, allowanceCleared: boolean, cause: DelegatedHaltCause, clearTransactionHash?: Hex | undefined);
+}
+/** Thrown by the signer itself once revocation was requested for the user on this rig (fail-closed). */
+export declare class RevocationRequestedError extends Error {
+    constructor(userId: string);
+}
+/** Classify a failure from its STRUCTURE (class, `errorType`) — never from its message text. */
+export declare function haltCauseOf(error: unknown): DelegatedHaltCause;
+/**
+ * Build a rig from raw operations. The raw operations are captured into the module-private registry;
+ * the returned object exposes only reads and revocation. (Callers who hold a CDP client already have
+ * the raw capability — this function does not create it, it fences it.)
+ */
+export declare function createCdpRig(raw: CdpRawOperations): CdpRig;
+/** Open a rig with Otto's developer credentials against Base mainnet. */
+export declare function openCdpRig(credentials: CdpDeveloperCredentials, rpcUrl?: string): Promise<CdpRig>;
+/**
+ * Revoke by `userId` alone, with read-back — usable even when the delegation request's response was
+ * lost (the grant may have committed remotely). Resolves only once the grant no longer reads back.
+ * This IS `rig.revoke`: serialized on the rig, lock held through the read-back, fail-closed afterwards.
+ */
+export declare function revokeDelegationByUserId(rig: CdpRig, userId: string): Promise<void>;
+export declare class CdpDelegatedSigner {
+    #private;
+    readonly capabilities: readonly SigningCapability[];
+    readonly chainId: 8453;
+    constructor(rig: CdpRig, user: CdpEndUser, options?: {
+        readonly sealedWait?: SealedWaitOptions;
+    });
+    get address(): Address;
+    get user(): CdpEndUser;
+    /**
+     * `send_evm_transaction`, under delegation: only a plan `assertPlanSignableBy` accepts for THIS user,
+     * re-checked before every step AND again immediately before each hand-off to CDP (after the nonce /
+     * fee / gas round trips, so an artifact that expires during preparation is never submitted). The plan
+     * halts at the first step that does not succeed; after ANY failure a bounded `approve(spender, 0)` is
+     * attempted under the same policy and its real outcome — confirmed by an allowance read-back — is
+     * reported. A failed reset may leave a pre-existing allowance, so step 0 is not exempt.
+     */
+    sendPlan(plan: VerifiedSwap): Promise<SentStep[]>;
+    /**
+     * The Otto-side kill switch, with read-back. Serialized on the rig (waits for any in-flight plan and
+     * its cleanup, holds the lock through the read-back) and fail-closed: no later plan for this user
+     * is submitted on this rig, whatever the read-back said.
+     */
+    revokeDeveloperSide(): Promise<void>;
+    delegation(): Promise<{
+        expiresAt: string;
+    } | undefined>;
+}